feat(cli): publish completed security scans to Linear

README.md

@@ -79,6 +79,29 @@ root cause, reuses saved matches, and identifies new, persisting, reopened,
 resolved, or unknown findings. Missing findings remain unknown when coverage is
 incomplete or their original location was not reviewed.
 
+## Publish scan findings
+
+Publish every finding from a completed scan to a Linear team:
+
+```bash
+npx @openai/codex-security publish scan /path/to/scan \
+  --to linear \
+  --linear-team TEAM_ID
+```
+
+Add `--project PROJECT_ID` to place the issues in a Linear project, or omit it
+to create issues directly in the team. Omit the scan directory to select a
+completed scan interactively. You can also set `CODEX_SECURITY_LINEAR_TEAM` and
+the optional `CODEX_SECURITY_LINEAR_PROJECT` instead of passing the destination
+flags. Add `--dry-run` to preview the issues or `--json` to return
+machine-readable results.
+
+Publishing uses your existing Codex sign-in and connected Linear app; no
+separate Linear token is required. Every finding creates a new issue containing
+the scan ID, affected code locations, source snippets, and remediation guidance.
+Choose a destination authorized to receive the repository's source code and
+vulnerability details.
+
 ## Verbose diagnostics
 
 Add `--verbose` to print scan diagnostics to stderr:

sdk/typescript/README.md

@@ -242,6 +242,8 @@ npx @openai/codex-security export
 npx @openai/codex-security export /path/outside/repository/results --export-format sarif --output /path/outside/repository/results.sarif
 npx @openai/codex-security export /path/outside/repository/results --export-format csv --output /path/outside/repository/findings.csv
 npx @openai/codex-security export /path/outside/repository/results --export-format json --output /path/outside/repository/findings.json
+npx @openai/codex-security publish scan /path/outside/repository/results --to linear --linear-team TEAM_ID
+npx @openai/codex-security publish scan --to linear --linear-team TEAM_ID
 npx @openai/codex-security validate /path/outside/repository/findings.json "Possible SQL injection in src/query.ts:42"
 npx @openai/codex-security validate "Possible SQL injection" --effort high
 npx @openai/codex-security patch /path/outside/repository/findings.json "Missing authorization check in src/routes.ts:18"
@@ -544,6 +546,72 @@ and scans stopped at their configured cost limit do not start another turn.
 invocation and defaults to `1`. Results remain under `--output-dir`; rerun the
 same command to resume.
 
+### Publish completed scans to Linear
+
+Publish every finding from a completed standard, deep, or scoped scan to one
+Linear team:
+
+```bash
+npx @openai/codex-security publish scan /path/to/completed-scan \
+  --to linear \
+  --linear-team TEAM_ID
+```
+
+Add `--project PROJECT_ID` to place the issues in a Linear project. Without a
+project, issues are created directly in the selected team.
+
+To choose from all completed scans saved in your local scan history, omit the
+scan directory:
+
+```bash
+npx @openai/codex-security publish scan \
+  --to linear \
+  --linear-team TEAM_ID
+```
+
+Destination flags take precedence over `CODEX_SECURITY_LINEAR_TEAM` and the
+optional `CODEX_SECURITY_LINEAR_PROJECT`. Use `--dry-run` to preview the issue
+titles without creating them, or `--json` to return structured publication
+results.
+
+Publishing starts Codex with your existing Codex configuration and connected
+Linear app. Sign in to Codex and connect Linear before publishing. The command
+does not require a Linear API token and does not use the isolated Codex home
+created for security scans.
+
+Each finding creates a separate new issue titled
+`[Codex Security][HIGH] Finding title`. The issue includes the scan ID,
+repository, scanned scope, source locations and code snippets, severity,
+confidence, vulnerability classification, summary, and remediation guidance.
+Verified immutable Git revisions include source links. Findings are published
+concurrently in batches of up to 20. Successful issue identifiers are linked
+to their findings in the local scan-history database, and structured results
+are read back from that database rather than generated by Codex. The completed
+scan must already exist in the local scan history. Running publication again
+creates another set of issues for the same scan; existing issues are not
+matched, updated, or reused.
+
+Issue descriptions contain source code and vulnerability details. Select a
+Linear destination authorized to receive that information. Publication receipts
+are stored separately from the sealed scan artifacts.
+
+You can also publish a scan from TypeScript:
+
+```ts
+import { publishScan } from "@openai/codex-security";
+
+const publication = await publishScan("/path/to/completed-scan", {
+  destination: "linear",
+  teamId: "TEAM_ID",
+});
+
+console.log(publication.scanId);
+console.log(publication.created.length);
+```
+
+Add `projectId: "PROJECT_ID"` to the options to publish into a specific Linear
+project instead of directly to the team.
+
 ### Scan history and reruns
 
 `scans` or `scans list` lists scans for the current repository. Pass a repository

sdk/typescript/scripts/smoke-package.mjs

@@ -1,6 +1,8 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import {
+  chmod,
+  cp,
   mkdir,
   mkdtemp,
   readFile,
@@ -344,7 +346,7 @@ try {
     [
       "--input-type=module",
       "--eval",
-      `const sdk = await import(${JSON.stringify(packageManifest.name)}); if (typeof sdk.CodexSecurity !== "function") throw new Error("The installed package does not export CodexSecurity.");`,
+      `const sdk = await import(${JSON.stringify(packageManifest.name)}); if (typeof sdk.CodexSecurity !== "function") throw new Error("The installed package does not export CodexSecurity."); if (typeof sdk.publishScan !== "function") throw new Error("The installed package does not export publishScan.");`,
     ],
     { cwd: consumer },
   );
@@ -398,6 +400,51 @@ try {
 
   const help = runInstalledCli("--help");
   assert.match(help, /Usage: codex-security\b/u);
+  assert.match(help, /\bpublish\b/u);
+
+  const publicationScan = join(consumer, "publication-scan");
+  await cp(
+    join(installedRoot, "_bundled_plugin", "examples", "completed-scan"),
+    publicationScan,
+    { recursive: true },
+  );
+  if (process.platform !== "win32") await chmod(publicationScan, 0o700);
+  const publication = JSON.parse(
+    run(
+      process.execPath,
+      [
+        launcher,
+        "publish",
+        "scan",
+        publicationScan,
+        "--to",
+        "linear",
+        "--linear-team",
+        "team-example",
+        "--dry-run",
+        "--json",
+      ],
+      {
+        cwd: consumer,
+        capture: true,
+        env: {
+          ...process.env,
+          CODEX_SECURITY_LINEAR_PROJECT: "",
+          CODEX_SECURITY_STATE_DIR: join(consumer, "publication-state"),
+        },
+      },
+    ),
+  );
+  assert.equal(publication.scanId, "scan_example_001");
+  assert.equal(publication.uploadId, publication.scanId);
+  assert.deepEqual(publication.destination, {
+    type: "linear",
+    teamId: "team-example",
+  });
+  assert.equal(publication.dryRun, true);
+  assert.equal(publication.counts.findings, 1);
+  assert.equal(publication.counts.created, 0);
+  assert.match(publication.issues[0].title, /^\[Codex Security\]\[HIGH\] /u);
 
   await smokeNestedDeepScanWorker(installedRoot, consumer);